The nightly's identity, as Terraform, and deliberately without its key

The nightly's identity, as Terraform, and deliberately without its key A scheduled run cannot borrow an SSO session, so the one long-lived credential this project needs is the nightly conformance runner's. Terraform because that is how infra here should be described, and in variables because this repository is public now — no account id, no bucket name, nothing that identifies whose account it runs in. **The access key is not in the module, and that is the point.** `aws_iam_access_key` puts the secret in Terraform state, and state is a file people commit, share and push to buckets. It would sit there for longer than the key does, and the usual mitigations — mark it sensitive, encrypt the state — protect the display rather than the storage. So the key is created once by a person and pasted into GitHub's secret store, which is write-only. Nothing that holds it also keeps a copy. The policy is least privilege derived rather than remembered: the fifteen S3 calls it allows are the ones `dam-store`'s driver actually makes, read out of the source. A policy written from memory becomes `s3:*` on a bucket, which is the same permission spelled at greater length. Object and bucket statements are separate because their resource ARNs differ — one statement covering both is how a scoped policy quietly stops being scoped. `.gitignore` learns about `.terraform/` and `*.tfstate` in the same commit, because a public repository is the wrong place to discover that habit was doing the work.